module-signature vulnerabilities and exploits

(subscribe to this query)

10

CVSSv2

Module::Signature prior to 0.74 allows remote malicious users to execute arbitrary shell commands via a crafted SIGNATURE file which is not properly handled when generating checksums from a signed manifest.

Module-signature Project Module-signature Canonical Ubuntu Linux 12.04 Canonical Ubuntu Linux 14.04 Canonical Ubuntu Linux 14.10 Canonical Ubuntu Linux 15.04

7.2

CVSSv2

Untrusted search path vulnerability in Module::Signature prior to 0.75 allows local users to gain privileges via a Trojan horse module under the current working directory, as demonstrated by a Trojan horse Text::Diff module.

Module-signature Project Module-signature Canonical Ubuntu Linux 12.04 Canonical Ubuntu Linux 14.04 Canonical Ubuntu Linux 14.10 Canonical Ubuntu Linux 15.04

6.4

CVSSv2

The PGP signature parsing in Module::Signature prior to 0.74 allows remote malicious users to cause the unsigned portion of a SIGNATURE file to be treated as the signed portion via unspecified vectors.

Module-signature Project Module-signature Canonical Ubuntu Linux 12.04 Canonical Ubuntu Linux 14.04 Canonical Ubuntu Linux 14.10 Canonical Ubuntu Linux 15.04

5

CVSSv2

Module::Signature prior to 0.74 allows remote malicious users to bypass signature verification for files via a signature file that does not list the files.

Canonical Ubuntu Linux 12.04 Canonical Ubuntu Linux 14.04 Canonical Ubuntu Linux 14.10 Canonical Ubuntu Linux 15.04 Module-signature Project Module-signature

4.4

CVSSv2

The cpansign verify functionality in the Module::Signature module prior to 0.72 for Perl allows malicious users to bypass the signature check and execute arbitrary code via a SIGNATURE file with a "special unknown cipher" that references an untrusted module in Digest/.

Canonical Ubuntu Linux 12.10 Canonical Ubuntu Linux 13.04 Canonical Ubuntu Linux 12.04 Opensuse Opensuse 11.4 Opensuse Opensuse 12.2 Opensuse Opensuse 12.3 Perlmonks Module\\ \\

4.3

CVSSv2

An issue exists on Samsung mobile devices with M(6.0) and N(7.0) (Exynos5433, Exynos7420, or Exynos7870 chipsets) software. An attacker can bypass a ko (aka Kernel Module) signature by modifying the count of kernel modules. The Samsung ID is SVE-2016-7466 (January 2017).

Google Android 6.0 Google Android 7.0

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook